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Summary 

The  USAF  believes  the  damage  tolerance  approach  incorporated  in  ASIP  process  in  the 
seventies  is  still  the  cornerstone  for  protecting  the  safety  of  our  aging  aircraft.  This 
process  is  primarily  deterministic  in  that  the  calculations  do  not  quantify  the  reliability  of 
the  process.  As  indicated  above,  however,  the  reliability  achieved  is  consistent  with  the 
new  aircraft  guidance  identified  in  USAF  structural  specification.  The  USAF  derives  the 
Force  Structural  Maintenance  Plan  (FSMP)  from  the  damage  tolerance  assessment  (DTA). 
The  FSMP  prescribes  for  the  maintainer  how,  when,  and  where  to  perform  inspections  to 
maintain  safety  of  flight.  There  are  cases,  however,  where  probabilistic  methods  need  to 
be  used.  It  is  the  purpose  of  this  paper  to  illustrate  the  use  of  probabilistic  methods  to 
ensure  structural  integrity. 


INPUT 

DATA: 


TASKS: 


OUTPUT:  INSPECTION  AND  MOD  REQUIREMENTS  BY  TAIL  NUMBER 


Figure  1 Damage  tolerance  approach 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects  ”,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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Role  of  Probabilistic  Methods 

in  the  seventies  and  eighties  there  was  considerable  activity  associated  with  the 
performance  of  DTAs  on  older  aircraft.  The  USAF  sometimes  found  the  DTA  revealed 
critical  locations  that  were  over  the  safety  limit,  in  these  cases,  the  USAF  policy  is  to 
ground  (or  severely  restrict)  these  airplanes  until  they  made  an  inspection.  In  some  of 
these  cases  the  inspection  was  so  onerous  they  grounded  the  aircraft  for  a long  time  thus 
hindering  training  operations.  Such  a case  occurred  on  the  F-5  dorsal  longeron.  The 
inspection  required  approximately  1350  work  hours  on  each  aircraft.  The  USAF  decided 
to  modify  the  structure  to  eliminate  this  inspection  burden.  To  determine  the  feasibility 
of  continued  use  of  the  aircraft  before  the  modification  the  USAF  performed  a risk 
assessment  based  on  the  method  described  in  [3].  This  method  considers  the  crack  length 
distribution  and  the  stress  distribution  as  random  number  sets.  The  procedure  further 
assumes  the  crack  growth  and  the  residual  stress  functions  are  deterministic. 

Another  opportunity  for  a risk  assessment  arose  when  the  USAF  needed  to  keep  the  T-37 
in  operational  service  after  the  cancellation  of  the  T-46  program.  The  USAF  subjected  the 
T-37  to  a damage  tolerance  assessment.  They  found  several  areas,  in  particular,  the  wing 
to  fuselage  attachment  area,  where  the  flight  hours  on  the  aircraft  exceeded  the  safety 
limit.  The  USAF  performed  an  extensive  risk  assessment  to  allow  these  airplanes  to 
continue  in  their  training  role  until  they  could  modify  them. 


Figure  2 Damage  tolerance  experience  - aircraft 
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In  all  of  these  cases  such  as  those  cited  above,  the  risk  assessment  did  not  include  the 
possibility  of  a “rogue  defect”  (as  assumed  in  the  damage  tolerance  assessment).  Rather, 
they  derived  the  flaw  distribution  from  extrapolation  of  defects  found  in  typical  structural 
details.  Therefore,  in  these  cases  the  structural  engineers  made  it  clear  to  the  aircraft 
operators  they  had  not  accounted  for  the  rogue  defect. 

Another  problem  where  the  risk  assessment  is  valuable  is  in  the  case  where  the  structure 
is  in  a state  of  generalized  cracking.  In  this  situation  the  inspection  intervals  derived  as 
indicated  above  from  the  deterministic  DTA  may  be  unconservative. 

The  USAF  had  an  opportunity  to  address  such  a situation  for  the  wings  of  the  T-38  aircraft 
operating  in  the  Air  Training  Command.  In  the  mid-seventies,  the  USAF  performed  a 
damage  tolerance  assessment  for  the  trainer  discussed  above  in  Air  Training  Command 
usage  [3],  This  study  concluded  they  should  inspect  the  wing  center  section  at  intervals 
of  1350  flight  hours.  They  based  this  on  an  inspection  capability  for  a corner  crack  of 
2.54  mm  and  an  inspection  at  one  half  of  the  safety  limit.  This  was  the  time  required  to 
grow  a crack  of  2.54  mm  to  a critical  size  crack  length  of  5.5  mm.  In  the  late  seventies,  a 
usage  change  took  place  that  made  the  loading  environment  more  severe.  The  USAF  made 
a damage  tolerance  reassessment  for  this  new  usage.  They  found  under  the  same  ground 
rules  the  recurring  inspection  interval  should  be  430  hours. 

To  provide  an  evaluation  of  the  necessity  of  performing  inspections  at  an  increased  rate, 
they  performed  a risk  assessment  for  the  new  usage,  but  old  inspection  schedule.  The 
assessment  based  on  an  inspection  interval  of  1350  flight  hours  showed  the  risk  was 
unacceptable.  When  they  reduced  the  inspection  interval  to  300  hours,  they  found  an 
acceptably  low  probability  of  failure.  Therefore,  they  concluded  they  had  to  improve  the 
inspection  reliability  or  decrease  the  inspection  interval  from  that  derived  from  the 
deterministic  DTA. 

There  are  other  cases  where  probabilistic  methods  can  complement  the  DTA.  These  cases 
typically  involve  difficulty  with  the  performance  of  the  DTA.  One  can  find  examples  of 
this  in  the  assessment  of  mechanical  subsystems.  Many  of  these  parts  are  not  tolerant  to 
the  size  defects  assumed  for  airframe  structure.  Also,  the  loading  environments  are 
difficult  to  simulate  analytically.  One  finds  another  example  in  the  high  strength  steel 
structures  such  as  gears.  In  these  cases  some  of  the  classical  reliability  approaches  may 
be  useful.  As  indicated  in  [4],  W.  Weibull  from  Sweden  performed  a number  of  fatigue 
experiments  in  the  middle  of  the  fifties.  He  found  the  results  of  these  experiments 
conformed  to  a probability  distribution,  known  today  as  the  Weibull  distribution. 

Figure  (3)  shows  Weibull  distributions  that  cover  the  range  normally  found  in  the  fatigue 
of  aircraft  structural  components.  One  notes  the  coefficients  of  variation  (the  standard 
deviation  divided  by  the  mean)  of  these  distributions  are  typically  much  higher  than  found 
for  static  strength.  Figure  (4)  shows  the  reliability  with  95  percent  confidence  as 
dependent  on  the  number  of  test  lifetimes.  The  results  shown  are  for  several  Weibull 
shape  numbers.  This  calculation  assumed  there  were  no  more  than  two  like  features  in  the 
aircraft.  One  sees  a high  reliability  structure  is  difficult  to  achieve  when  the  Weibull 
shape  number  is  of  the  order  of  two  or  three. 
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Figure  3 Weibull  probability  density  functions 


Figure  4 (1  - reliability)  with  95%  confidence 

One  of  the  problems  associated  with  the  early  applications  of  the  safe  life  approach  was 
that  it  did  not  account  for  the  fatigue  characteristics  of  the  individual  materials  in  the 
structure.  Therefore,  the  USAF  used  the  same  scatter  factor  independent  of  the  structural 
material  or  the  stress  spectra.  The  structural  analyst  knows  today  there  are  considerable 
differences  between  the  Weibull  scale  numbers  depending  on  material  and  spectra. 

The  currently  acceptable  structural  reliability  as  reflected  in  [2]  is  for  a single  flight  of  an 
aircraft  from  a given  population  the  probably  of  failure  should  be  no  greater  than  lO"7. 
This  means  the  desired  reliability  of  the  structure  should  be  of  the  order  of  0.999. 

Typically,  one  determines  the  Weibull  shape  number  through  testing  of  multiple  similar 
parts.  An  analytical  example  serves  to  illustrate  how  accurately  one  could  determine  the 
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Weibull  shape  number.  For  this  purpose,  one  may  sample  a population  with  a known 
Weibull  shape  number.  In  the  first  case  under  consideration  the  Weibull  shape  number  is 
two  and  the  analyst  selected  ten  random  samples  to  simulate  the  testing  of  ten  specimens. 
A simple  transformation  permits  plotting  these  ten  sample  points  on  a graph  where  the 
Weibull  distribution  is  a straight  line.  Further,  on  this  graph  the  negative  of  the  slope  of 
that  line  is  the  Weibull  shape  number.  Figure  (5)  shows  the  comparison  of  the  original 
distribution  and  the  sampled  distribution.  Figure  (6)  shows  these  distributions  in  the 
usual  manner.  One  may  use  the  same  process  to  sample  a distribution  where  the  Weibull 
shape  number  is  four.  Figure  (7)  and  Figure  (8)  show  these  results.  One  sees  for  small 
samples  such  as  used  here,  the  potential  for  error  in  the  assessment  of  the  Weibull  shape 
number  may  be  significant.  In  these  cases  the  judgment  on  the  reliability  of  the  structural 
component  could  be  in  considerable  error.  However,  if  one  adequately  interrogates  the 
population  the  results  are  useful.  Because  of  the  difficulties  cited,  the  USAF  recommends 
the  application  be  limited  to  structures  that  are  fail-safe. 


Figure  6 Weibull  sample  comparison  for  a = 2 
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Figure  7 Weibull  approximation  for  a = 4 and  10  samples 


Widespread  Fatigue  Damage 

A phenomenon  occurring  more  frequently  than  generalized  cracking  is  widespread  fatigue 
damage  (WFD).  WFD  is  a major  concern  in  aircraft  that  rely  on  fail-safety  for  structural 
integrity.  The  USAF  has  learned  WFD  can  degrade  the  fail-safe  capability  of  a structure 
with  cracking  that  is  of  the  order  of  one  to  two  millimeters  [5], 

A deterministic  definition  of  WFD  is  the  following:  The  onset  of  WFD  in  a structure  is 
characterized  by  the  simultaneous  presence  of  cracks  at  multiple  structural  details  which 
are  of  sufficient  size  and  density  whereby  the  structure  will  no  longer  meet  its  damage 
tolerance  requirement  (that  is,  maintaining  required  residual  strength  after  partial 
structural  failure). 
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In  many  cases  this  definition  is  difficult  to  apply  because  of  the  complex  cracking 
scenarios.  Further,  this  definition  may  lead  to  an  excessively  conservative  determination 
of  the  time  of  WFD  onset.  An  alternate  definition  that  removes  these  problems  is  the 
following:  The  onset  of  widespread  fatigue  cracking  is  that  point  in  the  operational  life  of 
an  aircraft  when  the  damage  tolerance  or  fail-safe  capability  of  a structure  has  been 
degraded  such  that  after  partial  structural  failure  the  probability  of  failure  of  the  structure 
falls  below  the  thresholds  specified  by  the  procuring  (or  certification)  agency. 

For  the  USAF,  the  threshold  single  flight  probability  of  failure  for  the  intact  structure  is 
10~7.  The  USAF  has  determined  the  threshold  for  the  acceptable  conditional  single  flight 
probability  of  failure  through  their  perception  of  the  discrete  source  damage  threat.  In  the 
case  of  the  C-5A  they  assumed  the  probability  of  discrete  source  damage  was  10~3  [6],  For 
the  case  of  the  707  they  assumed  it  was  10~4  [7]. 

One  of  the  primary  inputs  to  the  risk  assessment  approach  to  determine  the  onset  of  the 
time  to  WFD  is  the  distribution  of  cracks  in  the  structure.  The  USAF  has  determined  this 
distribution  through  teardown  inspections  of  full-scale  fatigue  test  articles  or  operational 
aircraft.  They  believe  this  is  the  best  method  currently  available  to  obtain  the  data 
required  to  derive  the  probability  distribution  function  for  equivalent  initial  cracks  in  the 
critical  areas  of  the  structure.  The  word  "critical”  here  refers  to  an  area  that  could 
significantly  contribute  to  the  probability  of  failure. 

The  probabilistic  approach  also  requires  that  the  analyst  determine  the  stress  density 
function  for  each  critical.  The  USAF  derives  this  function  from  the  available  usage 
information  generated  by  their  individual  aircraft  tracking  programs.  The  desired  stress 
density  function  is  the  one  for  a single  flight  of  an  aircraft  selected  at  random.  The 
structural  analyst  can  easily  derive  this  function  from  the  stress  exceedance  function 
developed  as  a part  of  the  deterministic  damage  tolerance  analysis.  One  can  then  compute 
the  joint  probability  distribution  of  cracks  and  stress  and  integrate  this  function  over  the 
point  set  where  the  crack  size  has  reached  critical  length.  The  result  of  this  calculation  is 
the  single  flight  probability  of  failure.  The  time  at  which  the  probability  of  failure  is 
unacceptable  is  the  onset  of  WFD. 

Therefore,  the  USAF  considers  the  cracks  in  the  structure  and  the  stresses  at  the  critical 
locations  as  random  number  sets.  The  crack  growth  function  and  the  residual  strength 
function  are  also  treated  as  random  functions  because  of  the  intrinsic  variability  of  the 
material  properties.  Unfortunately,  for  a given  population  of  aircraft  these  random 
number  sets  are  not  easily  quantifiable.  Fortunately,  the  variability  of  these  functions 
does  not  appear  to  have  a major  impact  on  the  risk  of  failure.  Therefore,  the  analyst  uses 
his  best  estimate  of  the  mean  of  these  functions  in  the  risk  assessment. 

The  damage  scenarios  in  an  airplane  that  could  constitute  WFD  differ  depending  on 
location  in  the  aircraft.  However,  typically,  they  fall  into  two  categories.  The  first  of 
these  is  multiple-site  damage  - characterized  by  cracks  in  multiple  details  in  the  same 
structural  element.  The  second  is  multiple-element  damage  where  there  are  cracks  in 
multiple  structural  elements. 

Previous  efforts  have  shown  the  analyst  can  readily  apply  this  type  of  analysis  to  the 
structures  where  the  concern  is  multiple-element  damage.  This  was  the  case,  for  example, 
for  the  KC-135  and  the  C-5A.  The  application  of  the  risk  assessment  technology  to  the 
case  of  multiple-site  damage  is  very  much  the  same  as  it  is  for  the  case  of  multiple- 
element  damage.  In  the  case  of  multiple-site  damage  there  will  typically  be  a "boundary" 
that  will  determine  if  the  cracking  has  the  potential  to  become  catastrophic.  For  example 
in  the  case  of  the  fuselage  lap  splice,  the  boundary  would  be  the  crack  stopper  built  into 
the  structure  at  the  frame  or  between  the  frames  and  its  surrounding  structure.  This  crack 
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arrest  feature  protects  the  integrity  of  the  structure.  The  condition  of  the  crack  stopper 
and  its  surrounding  structure  (that  is,  the  boundary)  will  determine  if  the  damage  could 
propagate  to  catastrophic  failure.  Therefore,  the  interest  is  primarily  in  the  degradation  of 
the  boundary  with  time  and  not  the  growth  of  the  holes  in  the  lap  splice  to  link-up.  When 
one  thinks  of  the  problem  in  this  manner,  then  it  may  be  solvable  in  a manner  similar  to 
that  used  for  the  multiple-element  damage  problem.  Lockheed  [8]  demonstrated  an 
example  this  of  this  in  their  risk  assessment  on  of  the  inner  to  outer  wing  joint  of  the 
C-141  aircraft. 

There  must  be  emphasis  placed  on  the  detection,  through  nondestructive  evaluation,  of 
cracks  that  could  be  significant  for  determination  of  the  onset  of  WFD.  As  indicated 
above,  there  is  a need  to  make  an  estimate  of  this  onset  based  on  probabilistic  assessment 
of  cracking  data  derived  from  the  teardown  inspection  of  fatigue  test  articles  or 
operational  aircraft.  One  must  recognize,  however,  that  this  is  only  an  estimate.  It  is  not 
realistic  to  expect  the  analyst  could  determine  this  time  with  great  accuracy  even  with  the 
most  sophisticated  fracture  mechanics  programs.  The  actual  time  may  be  either  somewhat 
earlier  or  later  than  this  estimate.  It  is  important,  therefore  to  be  able  to  validate  this 
prediction  with  nondestructive  evaluation.  This  is  difficult  because  the  size  of  defect  the 
inspector  must  find  is  quite  small.  The  experimental  evidence  to  date  indicates  cracks  of 
the  order  of  two  millimeters  can  significantly  lower  the  fail-safety  capability  of  certain 
structural  configurations. 

Weapon  System  Risk  Assessments 

C-5A  Risk  Assessment 

One  of  the  early  technical  challenges  for  this  program  was  how  long  to  leave  this  aircraft 
in  service  with  the  original  wing  design.  By  the  mid-seventies,  the  USAF  established  the 
damage  tolerance  initial  flaw  size  for  slow  crack  growth  structure  for  fastener  holes  as 
1.27  millimeters  [9],  On  the  basis  of  this  flaw  size  the  safety  limit  was  7,000  flight  hours 
of  the  so-called  14  mission  flight  profiles.  In  this  case  the  time  for  the  1.27  millimeter 
flaw  to  grow  to  the  critical  crack  length  was  the  safety  limit.  Since  the  wing  was  not 
inspectable,  this  was  also  the  life  limit  for  the  wing.  The  USAF  made  a final  validation  of 
the  life  of  the  wing  through  a teardown  inspection.  They  took  this  wing  from  service 
when  it  had  accumulated  7,000  hours  equivalent  to  the  14  mission  flight  profiles.  In  the 
teardown  inspection,  Lockheed  examined  44,641  fastener  holes  in  detail  for  cracking. 
They  did  this  work  in  the  late  seventies.  From  the  population  of  cracks  found  in  this 
teardown  inspection  the  USAF  performed  an  assessment  to  determine  the  probability  of 
catastrophic  failure  and  the  time  the  wing  lost  its  fail-safety.  The  USAF  found  that  at 

7,000  hours  the  wing  had  initially  exceeded  the  acceptable  10'^  single  flight  failure 
probability.  Further,  they  found  the  wing  had  lost  fail-safety  based  on  a conditional 

single  flight  failure  probability  of  10~4.  This  effort  confirmed  the  USAF  should  take  this 
structure  out  of  service  no  later  than  7,000  flight  hours  of  equivalent  14  mission  profile 
usage.  They  decided  to  allow  the  aircraft  to  fly  to  7,000  hours  with  fail-safety 
compromised  at  4,500  hours.  The  replacement  wing  box  will  easily  meet  the  original  life 
requirement  of  30,000  flight  hours. 

C-141  Risk  Assessment 

The  USAF  found  a major  WFD  problem  in  the  wing  at  Wing  Station  405  joint  [8],  The 
USAF  observed  first  cracking  on  an  operational  aircraft  in  late  1984.  In  early  1989,  they 
found  an  aircraft  with  a severed  beam  (or  spar)  cap.  The  USAF  recommended  that 
Lockheed  perform  a risk  assessment  based  on  operational  aircraft  cracking  data  to  assess 
the  likelihood  of  catastrophic  failure  of  the  aircraft.  The  risk  assessment,  as  expected, 
indicated  the  joint  was  extremely  critical..  The  USAF  had  found  numerous  cracks  in  the 
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area  of  the  rear  beam  on  many  airplanes.  In  addition,  they  found  a number  of  spar  cap 
failures.  Also,  there  have  been  multiple  cracks  discovered  in  the  area  of  the  forward  beam 
on  many  airplanes.  The  risk  assessment  performed  by  Lockheed  showed  although 
inspections  were  somewhat  effective  in  reducing  the  risk,  the  best  alternative  was  to 
perform  a modification  on  the  joint.  The  USAF  initiated  aircraft  restrictions,  an 
inspection  program,  and  an  accelerated  modification  program  to  alleviate  this  problem. 
The  action  to  remove  WFD  by  a modification  is  similar  to  the  earlier  actions  taken  on  the 
KC-135  and  C-5A  [6],  In  the  case  of  the  KC-135  and  C-5A  the  emphasis  was  on  the 
elimination  of  the  WFD  problem  rather  than  trying  to  manage  it  through  an  inspection 
program. 

The  USAF  found  another  major  WFD  problem  in  wing  lower  surface  fuel  transfer  holes 
(weep  holes).  There  are  more  than  1500  such  weep  holes  in  each  wing  (both  sides).  The 
cracking  experiences  with  the  weep  holes  dates  back  to  the  original  fatigue  test.  After 

90.000  hours  of  block  testing  on  the  test  article,  Lockheed  found  cracking  in  many  of  the 
weep  holes.  Lockheed  cold  expanded  these  holes  before  they  resumed  testing  with  flight- 
by-flight  loading.  The  additional  28,468  hours  of  testing  showed  the  cold  expansion  was 
effective  in  controlling  the  weep  hole  cracking.  Lockheed  made  a recommendation  to 
WR-ALC  in  September  of  1983  to  perform  the  cold  expansion  on  C-141  aircraft  with 

30.000  hours.  In  January  1993  the  USAF  Scientific  Advisory  Board  (SAB)  reviewed  the 
potential  for  a service  life  extension  of  the  C-141.  They  found  the  USAF  had  cold 
expanded  weep  holes  on  only  six  operational  aircraft.  They  also  found  the  weep  hole 
inspection  results  were  difficult  to  understand.  One  aircraft  the  USAF  had  found  ninety- 
nine  weep  hole  cracks,  the  longest  of  which  was  approximately  12  millimeters.  They 
found  other  aircraft  relatively  free  of  cracks.  However,  there  had  been  several  cases 
where  the  weep  hole  cracks  had  progressed  through  the  skin  and  had  caused  in-flight 
evident  fuel  loss.  To  understand  this  apparent  anomaly,  the  SAB  recommended  a 
teardown  inspection  of  an  aircraft.  The  USAF  tore  down  aircraft  number  66-0186,  in 
which  the  USAF  had  found  ninety-nine  cracks.  It  had  23,824  flight  hours  of  relatively 
high  damage  usage,  which  converted  to  44,539  damage  hours  (that  is,  hours  of  equivalent 
SLA-IIB  spectrum  usage)  on  the  lower  inner  wing  skin.  The  teardown  inspection  on 
aircraft  number  66-0186  has  revealed  numerous  holes  with  poor  quality  and  a total  of  255 
cracked  holes.  Subsequently,  WR-ALC  performed  an  additional  inspection  and  a limited 
teardown  inspection  on  66-9410,  which  had  45,202  equivalent  damage  hours  on  the  inner 
wing  lower  surface.  The  results  of  the  additional  inspection  have  shown  there  was 
extensive  cracking  in  the  weep  holes  of  this  aircraft.  Consequently,  the  USAF  concluded 
the  cracking  observed  in  these  two  is  representative  of  the  aircraft  with  that  number  of 
equivalent  damage  hours.  They  concluded  the  early  inspection  results  were  unreliable. 
They  changed  the  inspection  procedure  and  validated  it  on  a teardown  inspection  aircraft. 
The  size  of  the  cracks  found  led  them  to  the  conclusion  there  was  severely  degraded  fail- 
safe capability  in  the  wing.  Also  as  indicated  by  the  distribution  of  cracks,  the  cracks 
tend  to  line  up  which  contributes  to  the  loss  of  fail-safety.  These  airplanes  were  in  a state 
of  WFD.  Therefore,  the  USAF  placed  the  airplanes  on  restrictions  and  an  inspection 
program.  They  developed  an  inspection  program  designed  to  preclude  the  cracks  from 
reaching  critical  length  and  failing  a wing  panel.  In  addition,  they  developed  a 
modification  program  to  eliminate  this  problem.  The  modification  program  consisted  of 
three  parts.  They  found  they  could  remove,  or  nearly  remove,  most  of  the  cracks  by 
reaming  them.  They  elected  to  cold  expand  these  holes.  In  many  airplanes  there  were 
only  approximately  ten  locations  where  cold  expansion  was  not  an  alternative  because  the 
cracks  were  too  large.  Fortunately,  at  this  time,  the  Wright  Laboratory  was  completing  a 
major  program  that  would  give  the  USAF  the  technology  for  patching  metallic  structures 
with  composites.  This  appeared  to  be  a more  attractive  alternative  than  the  conventional 
metallic  patches  that  required  additional  fastener  holes  in  the  lower  surface  of  the  wing. 
Therefore,  the  modification  for  those  airplanes  with  a small  number  of  large  cracks  would 
be  composite  patching.  For  aircraft  that  had  a large  number  of  large  cracks  the  only 
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alternative  was  replacement  of  wing  panels.  Lockheed  performed  a risk  assessment  to 
better  understand  the  severity  of  the  weep  hole  cracking  problem.  After  reviewing  the 
results  of  this  assessment,  the  USAF  made  recommendations  for  subsequent  actions.  They 
decided  not  to  fly  any  aircraft  that  had  in  excess  of  40,000  damage  hours  on  the  lower 
inner  wing  surface  until  they  performed  a weep  hole  inspection.  They  would  inspect  the 
remainder  of  the  aircraft  and  modify  them  based  on  a one  year  schedule.  They  found  weep 
hole  cracking  in  practically  all  of  the  aircraft.  The  nondestructive  inspection  program 
revealed  a total  of  1 1,000  cracks  in  the  weep  holes  in  the  entire  fleet.  The  USAF  found  no 
cracks  in  the  weep  holes  that  had  been  cold  expanded.  WR-ALC,  with  the  support  of  the 
Wright  Laboratory  [9],  accomplished  the  tremendous  task  of  restoring  these  airplanes  to 
flight  status.  They  repaired  the  wings  carefully  with  composite  patching  to  ensure  they 
had  not  degraded  structural  integrity  of  the  aircraft.  They  returned  these  airplanes  to 
unrestricted  usage  when  they  placed  them  back  into  service. 

The  USAF  believed  that  WFD  of  the  inner  wing  spanwise  splices  was  a significant  factor 
in  the  C-141  continued  airworthiness.  They  had  learned  this  from  the  loss  of  fail-safety  in 
the  C-5A  wing.  In  1990  the  USAF  [11]  estimated  they  could  expect  WFD  in  the  spanwise 
splices  in  inner  wing  lower  skin  at  about  45,000  SLA-I1  equivalent  flight  hours.  They 
based  this  estimate  the  teardown  inspection  of  the  C-141  fatigue  test  article  (Specimen 
A)..  The  size  of  cracks  that  could  cause  loss  of  fail-safety  in  the  C-141  inner  lower  wing 
is  in  the  order  of  1.5  millimeters.  Lockheed  performed  an  additional  assessment  of  the 
risk  based  on  teardown  inspections  of  wing  panels  taken  from  operational  aircraft.  They 
found  significant  degradation  of  fail-safety  at  37,000  hours.  The  USAF  made  the  decision 
to  manage  the  safety  of  those  airplanes  above  37,000  hours  by  slow  crack  growth.  This 
decision  resulted  in  a very  difficult  inspection  program  [7], 

707  Risk  Assessment 

The  USAF  elected  in  the  eighties  to  use  the  707  aircraft  for  Joint  Stars  (Joint  Surveillance 
Target  Attack  Radar  System).  When  Northrop  Grumman,  the  contractor  for  Joint  Stars, 
selected  the  aircraft,  the  configuration  was  the  primary  concern  - not  the  age.  Many  of 
the  airplanes  selected  were  close  to  (or  above)  the  original  life  goals  of  sixty  thousand 
flight  hours  and  twenty  thousand  flights  established  by  Boeing  for  the  707. 

The  largest  concern  about  the  structure  of  this  aircraft  was  the  potential  for  the 
degradation  of  fail-safety  because  of  WFD  in  the  wing.  Boeing  performed  a teardown 
inspection  on  a relatively  high  time  aircraft  in  the  mid  seventies.  The  inspection 
performed  by  Boeing,  completed  in  1976,  revealed  numerous  cracks  in  the  aircraft.  The 
cracks  that  caused  the  most  concern  were  in  the  lower  wing  splicing  stringers  and  the 
large  stringers  around  the  lower  wing  inspection  holes  adjacent  to  the  splicing  stringers. 
Boeing  published  several  Service  Bulletins  as  a result  of  these  wing  crack  findings.  These 
Service  Bulletins  called  for  either  a high  frequency  eddy  current  inspection  inside  of  the 
wing  or  an  external  low  frequency  eddy  current  inspection.  These  inspections  have 
revealed  major  damage  including  a severed  stringer  and  skin  cracks  in  excess  of  44 
millimeters.  The  Boeing  database,  however,  was  not  definitive  enough  to  be  usable  in  an 
assessment  of  the  risk  of  failure.  Consequently,  the  USAF  contracted  with  Boeing  to 
examine  higher  time  aircraft  parts  taken  from  retired  aircraft  at  Davis  Monthan  Air  Force 
Base  to  quantify  the  risk  associated  with  WFD  [7], 

Boeing  performed  a teardown  inspection  on  a 707-300  wing  from  an  aircraft  at  Davis 
Monthan  Air  Force  Base.  This  aircraft,  representative  of  the  Joint  Stars  aircraft,  had 
experienced  57,382  flight  hours  and  22,533  flights.  They  performed  the  teardown 
inspection  on  the  wing  lower  surface  and  the  wing  stringers.  Stringers  and  skins  where 
Boeing  used  steel  fasteners  contained  most  of  the  cracks  found.  This  was  typically  in  the 
area  of  the  wing  skin  splices  and  the  large  adjacent  stringers.  The  beneficial  effects  of 
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the  aluminum  rivets  attaching  the  other  stringers  to  the  wing  skins  apparently  reduced  the 
amount  of  cracking  there.  There  was,  however,  some  cracking  found  in  these  locations. 

Boeing  found  that  cracking  in  the  aircraft  in  the  area  of  the  steel  fasteners  was  quite 
extensive.  They  found  a total  1915  cracks  found  in  five  sections  removed  from  the 
aircraft.  Most  of  the  cracks  found  were  small.  However,  they  found  a significant 
population  cracked  to  the  point  of  considerable  concern.  They  found  that  increasing  the 
size  of  the  holes  in  the  splicing  stringer  and  the  large  adjacent  stringer  would  not  remove 
all  of  the  cracks.  About  twenty  percent  of  these  holes  would  still  have  stringer  cracks. 
Further,  they  found  significant  cracking  outboard  of  the  Wing  Station  360  production 
joint.  Therefore,  the  problem  involved  most  of  the  wing.  Typically,  the  large  adjacent 
stringers  had  more  large  cracks  than  the  splicing  stringers.  The  largest  crack  found  in  a 
stringer  was  approximately  38  millimeters  in  length.  It  was  near  the  point  of  rapid 
fracture.  There  were,  however,  many  cracks  found  that  would  have  gone  to  failure  in  the 
planned  life  span  of  the  Joint  Stars  aircraft.  There  was  a concern  about  cracking  that 
would  degrade  the  capability  of  the  structure  to  sustain  discrete  source  damage.  There 
was  also  a concern  about  the  fatigue  failure  of  the  stringers  and  subsequent  catastrophic 
loss  of  the  aircraft  after  a skin  failure. 

Boeing  calculated  the  stress  intensity  of  each  of  the  cracks  found.  They  then  determined 
for  each  of  them  the  size  of  the  corner  crack  with  the  same  stress  intensity.  From  these 
cracks,  the  USAF  derived  the  crack  distribution  function.  They  used  a population  taken 
from  the  largest  of  them  to  approximate  the  crack  distribution  with  a two  parameter 
Weibull  distribution  function.  It  is  typical  that  a single  Weibull  distribution  function  will 
not  approximate  the  longer  cracks  as  well  as  the  shorter  cracks.  This  is  not  a problem 
since  only  the  longer  cracks  will  have  a significant  effect  on  the  risk  of  failure. 

The  USAF  needed  two  stress  distribution  functions  for  the  assessment.  The  first  is  the 
stress  distribution  function  for  the  intact  structure.  Boeing  derived  this  in  the  usual 
manner  from  the  intended  usage  of  the  aircraft,  the  external  load  analysis,  and  the  stress 
analysis  of  the  wing.  Second,  for  the  cases  where  discrete  source  damage  was  present 
they  determined  the  local  stress  increase  from  the  damage.  In  many  cases  the  local  stress 
increased  to  the  point  where  there  was  significant  plastic  deformation  of  the  structure. 
When  this  occurs  it  is  essential  the  plastic  deformation  be  included  in  the  analysis.  A 
linear  analysis  in  these  cases  would  likely  lead  to  serious  errors  in  the  determination  of 
risk. 

For  the  cases  of  discrete  source  damage  the  maximum  single  flight  failure  probability 
allowed  was  10"’  and  for  the  intact  structure  case  the  maximum  single  flight  failure 
probability  allowed  was  10‘7.  For  the  stated  criteria  for  discrete  source  damage,  the  USAF 
found  significant  degradation  of  fail-safety  beyond  50,000  flight  hours  of  commercial 
usage.  Therefore,  for  some  aircraft,  there  will  be  unacceptable  fail-safety  degradation 
before  the  end  of  the  planned  20,000  hours  of  Joint  Stars  usage.  This  will  occur  for  Joint 
Stars  aircraft  with  more  than  36,000  commercial  usage  hours.  Further,  for  the  case  of  no 
discrete  source  damage,  there  will  be  safety  degradation  beyond  58,000  hours  of 
commercial  usage.  Therefore,  aircraft  with  initially  more  than  44,000  hours  of 
commercial  usage  will  have  a high  probability  of  failure  before  operationally  flying 
20,000  hours. 

There  are  two  possible  approaches  for  solution  of  this  problem.  The  first  is  to  remove  the 
steel  fasteners  in  the  area  of  concern  in  the  lower  wing  surface  and  perform  an  eddy 
current  inspection.  If  the  inspector  finds  no  indication  of  a crack  or  if  increasing  the  size 
of  the  hole  would  remove  the  indication,  then  this  hole  would  be  cold  expanded.  For 
cracks  that  are  too  large  for  this  remedy,  the  USAF  could  utilize  a repair  such  as 
composite  patching.  This  approach  appears  to  be  viable  for  aircraft  with  less  than  45,000 
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commercial  usage  flight  hours.  It  also  may  be  viable  for  aircraft  in  the  45,000  to  55,000 
flight  hour  range.  A second  alternative  would  be  to  replace  the  wing  panels  and  stringers 
in  the  area  of  concern.  This  may  be  the  only  alternative  for  aircraft  with  more  than 
55,000  commercial  usage  flight  hours. 

Widespread  Fatigue  Damage  Example  Risk  Assessment 

The  following  example  illustrates  some  of  the  essential  features  of  the  risk  analysis 
process.  The  example  determines  the  risk  of  catastrophic  failure  for  both  the  intact  and 
partially  failed  structure  of  a hypothetical  aircraft  designed  for  a 30,000  hour  life.  The 
aircraft  is  to  fly  only  one  mission  that  is  two  hours  in  length.  The  aircraft  has  one  critical 
area  with  500  fastener  holes.  The  initial  crack  distribution  is  the  crack  distribution 
function  derived  from  a teardown  inspection.  Figure  (9)  shows  the  corresponding  crack 
density  function.  Figure  (10)  shows  the  corresponding  crack  distribution  function.  For 
the  intact  structure,  Figure  (11)  shows  the  stress  exceedance  function  for  each  of  these 
holes.  Figure  (12)  shows  the  corresponding  stress  probability  distribution  function, 
derived  from  the  exceedance  function.  Figure  (13)  shows  the  stress  density  function.  The 
threat  of  discrete  source  damage  is  1CTJ.  For  the  partially  failed  structure,  only  ten  of  the 
500  fastener  holes  have  their  stress  increased  to  1.5  times  the  stress  for  the  intact 
structure.  Figure  (14)  shows  the  residual  stress  function.  The  crack  growth  function 
modifies  the  initial  crack  distribution  function  so  the  crack  probability  distribution  has 
the  correct  time  dependence.  Figure  (15)  shows  the  crack  growth  function.  Figure  (16) 
shows  the  final  function  needed  for  the  calculation  of  risk.  This  is  the  inspection 
probability  of  detection  function. 


Figure  9 Crack  density  function  from  the  A-7D 
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Crack  length  in  millimeters 

Figure  10  Crack  distribution  function  from  the  A-7D 


Figure  11  Stress  exceedance  function 
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Crack  length  in  millimeters 
Figure  16  Probability  of  detection  function 

Figure  (17)  shows  the  single  flight  probability  of  failure  for  the  intact  structure  without 
inspections.  From  this  figure,  one  sees  the  risk  exceeds  the  10"7  threshold  of  acceptability 
at  about  22,000  flight  hours.  From  Figures  (14),  (15),  and  (16)  the  analyst  can  determine 
the  damage  tolerance  inspections.  The  first  inspection  is  at  7600  flight  hours  and  the 
inspection  interval  following  the  first  inspection  is  5000  hours.  Figure  (18)  shows  the 
single  flight  probability  of  failure  for  the  intact  structure  with  inspections.  One  sees 
these  inspections  are  quite  effective  in  reducing  the  risk  of  failure  and  containing  the  risk 
within  acceptable  limits  to  30,000  flight  hours.  It  is  clear  from  this  figure  that  on  the 
basis  of  the  inspection  capability  assumed  and  the  inspection  interval  derived  from  the 
damage  tolerance  methodology  the  risk  is  increasing  significantly.  Therefore,  one  must 
make  a reduction  in  the  inspection  period  if  one  intends  to  fly  the  aircraft  significantly 
beyond  its  original  life  of  30,000  flight  hours. 


Single  flight  failure  probability 


Figure  17  Intact  structure  with  no  inspections 
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Single  flight  failure  probability 


Figure  18  Intact  structure  with  inspections 


Figure  (19)  shows  the  single  flight  failure  probability  for  the  partially  failed  structure 
without  the  effect  of  inspections.  This  is  the  conditional  probability  for  the  structure 
damaged  from  an  external  source.  One  sees  the  risk  crosses  the  threshold  of  acceptability 
for  this  case  (that  is,  10"4)  at  approximately  16,000  flight  hours.  The  aircraft  has 
degraded  fail-safe  capability  long  before  the  time  the  intact  structure  has  reached  the 
unacceptable  risk  threshold.  Figure  (20)  shows  the  influence  of  inspections  on  the 
probability  of  failure.  One  sees  the  inspections  are  essentially  ineffective  in  reducing  the 
risk  for  this  case.  This  example  clearly  illustrates  the  damage  tolerance  derived 
inspection  program  may  not  adequately  protect  the  fail-safety  of  an  aircraft  in  the 
presence  of  widespread  fatigue  cracking. 

Single  flight  failure  probability 


Thousands  of  flight  hours 


Figure  19  Damaged  structure  with  no  inspections 


5-18 


Single  flight  failure  probability 


Figure  20  Damaged  structure  with  inspections 

Conclusions 

As  indicated  above,  the  cornerstone  for  protecting  the  safety  of  USAF  aircraft  is  damage 
tolerance.  There  are  some  cases,  however,  where  probabilistic  methods  find  an  important 
use.  One  approach  that  appears  to  be  attractive  especially  for  mechanical  subsystems  is 
the  use  of  reliability  analyses  based  on  testing.  In  some  cases  these  methods  can  provide 
satisfactory  solutions  where  a damage  tolerance  assessment  may  be  impractical.  The 
USAF  believes  the  process  may  apply  to  mechanical  subsystems  since  they  are  typically 
fail-safe  by  design. 

A major  problem  in  aging  aircraft  is  WFD.  It  is  essential  to  establish  an  estimate  of  the 
time  of  onset  of  this  problem.  The  USAF  does  this  through  the  analysis  of  data  derived 
from  teardown  inspections  of  fatigue  test  articles  and  of  operational  aircraft.  They  will 
need  to  corroborate  these  estimates  through  the  use  of  detailed  inspections  of  suspect 
structural  elements.  In  some  cases  the  nondestructive  inspection  capability  does  not  exist 
to  economically  find  WFD  size  cracks.  The  USAF  must  continue  their  effort  to  attain  this 
capability.  Once  the  aircraft  operator  determines  the  aircraft  has  reached  the  time  of 
onset  of  WFD,  he  needs  to  make  modifications  of  the  structure  to  remove  this  problem. 
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